13 ms·
WDMyCloud Multiple Vulnerabilities
- ronnier 9y agoReddit thread: https://www.reddit.com/r/PleX/comments/7odjds/secret_hardcoded_backdoor_and_other/ https://www.reddit.com/r/PleX/comments/7odjds/secret_hardcod...
- deleted 9y ago[deleted]
- notadoc 9y agoYikes. I suspect there are many more of these out there.
- madez 9y agoWhen you use proprietary solutions you have it coming.
- Johnny555 9y agoWhile that may be true, it no one should expect to be backdoored by using a proprietary product.
- craftyguy 9y agoI (strongly) disagree. You should expect the worst when using crap that you, or anyone else (publicly) cannot verify. To expect any less is to become complacent. Products, and companies behind them, must earn your trust, and hiding behind binary blobs is not the way.
- btgeekboy 9y agoYour parent post is talking about expectations. You are talking about reality. Just as everyone should have access to clean water and medical care, but that’s not actually true.
- craftyguy 9y agoIf you don't have access to clean water, you should publicly object. If you don't know how to determine if you have clean water (e.g. the parent comment), then either you demand proof or expect, uh, dynsentery and a bad time. You should not assume you have clean water.
- djsumdog 9y agoI mean yes, you or I might just get an ITX board or a Pi and run our own Linux on it to setup a NAS, but most of the average users aren't going to do that, mostly because they don't have the knowledge or expertise, or because they don't have the time. Vendors with names people trust should be held accountable when they fuck up like this. Also you can't trust everything all the way down. A Pi still has proprietary video chips, every Intel and AMD board has some kind of management software, etc. etc. There is no way for one human being to be all Tony Stark and build literally everything from the ground up.
- borplk 9y agoNot everyone is a leet open source enthusiast lisp-loving kernel-compiling hacker. People go to the shop down the block, pick a product from the shelf and they are done with it. This doesn't make them deserving of backdoors. "Bought the wrong brand of car ... you had that accident coming" "Visited the wrong doctor ... you had it coming" "Ate food at the wrong restaurant ... had it coming" Not everyone is going to be an expert in every field. This is not how a modern society works.
- nickik 9y agoWhile I agree with you. You can just buy a product with Open Source software. Those exists but not for every possible product you might want. That said, for Hardware this does not yet work, and firmware is of course another problem. Lets hope for a better future.
- f2n 9y agoQuite the opposite, actually: Everyone should expect to be backdoored by proprietary products if they use them, and take appropriate security measures.
- duncan_bayne 9y agoReally? I'd have thought the exact opposite, based on the number of backdoors discovered in devices like these.
- Digital-Citizen 9y agoYes, and for good reason: https://www.gnu.org/proprietary/proprietary-back-doors.html https://www.gnu.org/proprietary/proprietary-back-doors.html has a list of some of the backdoors found in proprietary software (software users are not free to run, inspect, share, and modify). https://www.gnu.org/proprietary/ https://www.gnu.org/proprietary/ has a list of other kinds of malware found in proprietary software sorted by type and company or type of product. It's very informative reading and touches on issues which often come up on sites like Hacker News.
- shitloadofbooks 9y agoThis is utter nonsense. Why's it my mum's fault for buying one of these? Also, ignoring the backdoor and focusing on the other exploits, fairly popular open source software has had similar exploits.
- madez 9y agoI didn't state how I think it should be, but how reality is. Now, for your mother, the government has the responsibility to protect the people from harms the people can't solve on their own. This happens in crime investigations, ecological regulations, car regulations and nuclear material regulation, among many other areas. In my eyes, security in IT products is clearly one of those areas. Your mother should ask the politician she voted for why they don't fulfill their responsibility. In Germany, the highest court has stated legally binding in a decision in 2016 (red point 38 in [0]) that the state is responsible for the confidentiality and integrity of the IT equipment of the population. So far the german government chose to ignore that decision. [0] https://www.bundesverfassungsgericht.de/SharedDocs/Entscheidungen/DE/2016/04/rs20160420_1bvr096609.html https://www.bundesverfassungsgericht.de/SharedDocs/Entscheid...
- scott_karana 9y agoMerely installing Ubuntu on a ThinkPad doesn't disclaim you of proprietary software, by a long shot. Do you also run an open BIOS, no CPU ME, no cellphone basebands, OSS controllers in your hard drives, and control the firmware on all of your USB/PCIe peripherals? If you actually do, you ought to realize that you're a one in hundreds of millions type individual, and that those hoops don't work for most people; even technically minded ones. And if you don't, you're a hypocrite who should be more sympathetic to the numerous compromises that exist in reality.
- madez 9y ago> Do you also run an open BIOS, no CPU ME, no cellphone basebands, OSS controllers in your hard drives, and control the firmware on all of your USB/PCIe peripherals? I saddly can't answer all these questions with yes yet, but I'm constantly looking to improve that situation. Still, my situation is better in that regard than what most people have. Most people are literally illiterate in the digital world. Schools are failing in this aspect. Often they ignore the digitalization or think it just means to use new media and the internet, which is the totally wrong angle to teach this transformation of our world. Google is especially evil in trying to profit from this situation by creating schooling centres where Google teaches its vision of a digital world using its tools and services. > And if you don't, you're a hypocrite who should be more sympathetic to the numerous compromises that exist in reality. Why am I a hypocrite for stating a simple fact? If you use propietary system, you are at the mercy of somebody else who most likely woudn't even answer your questions about it. I'm very sympathetic to what happens to people around me and also those that are not around me. That is why I advocate for legislation and regulation to solve this problem. The state must fund free and open software and legally require open documents. Also, they must finally get their shit together and properly integrate the digital world into schools, and no, this is not done by giving every child a tablet. I want this to get better for everyone. Still, I have little sympathy for the decision to buy for example Apple products. There are alternatives that are more open. Whoever chooses the closed system whenever an open alternative exists unnecessarily takes a risk by given a very limited set of people a lot of power over them. Don't do that, don't choose proprietary systems. Don't use Windows, don't use Apple products. It's not hard not to.
- jwilk 9y ago"Secret hard-coded backdoor" makes no sense. Please use the orignal title.
- Johnny555 9y agoWhat part makes no sense? The backdoor in question is "secret", it's "hard-coded" and it's a "backdoor". Saying "secret backdoor" may be redundant, but it still makes sense.
- IncRnd 9y ago"Secret hard-coded backdoor" makes sense to me, because the linked webpage illustrates a secret hard-coded backdoor in the product.
- alsetmusic 9y agoRegardless: > […] Otherwise please use the original title, unless it is misleading or linkbait. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- LukeShu 9y agoWhile I'm not a fan of the title it was submitted with, a backdoor is a heck of a lot different than a "normal" vulnerability; to the point where just saying "vulnerability" is a bit misleading. Perhaps: "WD MyCloud Multiple Vulnerabilities (including hard coded backdoor)"
- IncRnd 9y agoNobody is disputing that, so why even bring it up? Whether "secret hardcoded backdoor" is misleading was being discussed.
- aeleos 9y agoIf you look in the document there is a section about a hard-coded backdoor admin account that cannot be changed. So secret hard-coded backdoor does make sense to me.
- aeleos 9y agoI always wondered they were able to sell these devices so cheaply. I recently bought 2 4tb ones to take the hard drives out as they were each $30 cheaper than buying a regular 4tb hardrive.
- jquast 9y agoYou're not kidding. We recently bought a few dozen of them from bestbuy, ripped them apart for the disks, and put the disks in a NAS.
- grawlinson 9y agoThis is apparently common practise amongst data hoarders, especially after the flooding affected HDD production in Asia.
- whoopdedo 9y agoI considered that but gut instinct told me the cost had to be cut from somewhere and made me afraid of the failure rate.
- aeleos 9y agoYou would think that but at least with the 8tb version they are often standard red drives that look the exact same as any other. It could be just that since they are their own drives, they can afford to price the hard drives much closer to their manufacturing costs.
- mikepurvis 9y agoI think it's standard price discrimination— internal drives are often bought alongside other expensive equipment as part of a "build" so that purchaser is a lot less price sensitive overall than someone who walks into Best Buy looking for a USB3 drive to use with Time Machine.
- curun1r 9y ago
- ksec 9y agoI am now less sure how anything is secured once it can be reached through the Internet. May be I have the old way of a NAS that is NOT reachable through the internet at all. I really want a Time Capsule for all my iOS devices,, and have it only accessible within my Network. But then i am also paranoid about Bit rot on HDD. As I have seen far too many of my Photos or Video with this problem. And I dont believe any consumer grade NAS are quite capable of handling them yet. I have yet to find a usecase where I want ALL of my files, Photos, Movies or whatever accessible when ever I am. Most of the time I only need one file form work, and it is normally in dropbox or email.
- _Codemonkeyism 9y agoInteresting, how do you think bitrot affects a NAS with ECC/ZFS/RAID10 ?
- rawnlq 9y agoAll your bits will rot if your house burns down. You will need something cross region (maybe your whole city gets nuked) but then you'll be exposed to the internet again. Snail mail your drives I guess?
- nickik 9y agoIf you want to pay the money get ZFS and you can easly backup the ZFS snapshots to rsync.net.
- _Codemonkeyism 9y agoWhich is what I do.
- KozmoNau7 9y agoIf you want remote access, don't make the NAS directly accessible from the internet, set up a properly secured VPN instead. It is an additional step, but you'll be the one in control of access, not whichever faulty services are running on your NAS. And don't buy a NAS appliance, buy an inexpensive server like a Lenovo TS150 or HP MicroServer, add a couple of RAID disks (Btrfs or ZFS preferred over hardware or software raid) and run something Linux/BSD based that you have better control over. Btrfs and ZFS should be able to prevent bitrot. ECC memory is highly recommended.
- cordite 9y agoI recently moved to a FreeNAS machine, as these devices had the weakest CPU and little ram as possible to function. It made buffering media on the network a challenging task when it should have been effortless.
- madez 9y agoA relevant but still more general question: How can we protect ourself against backdoored products that are covertly subsidized by governments? Sure, demanding the sources is a necessary first step. But what happens when the manufaturer blocks and there is not enough competition in the market, see Intel and laptops? This situation has been a problem for years now. What can be done? What regulation or law would help? What should we demand?
- gruez 9y agoopen source is only going to protect you from non-intentional backdoors. if the government really wanted a backdoor, there's nothing preventing them from loading a modified version that has a backdoor. short of dumping the firmware from nvram + reproducible builds, you won't be safe.
- madez 9y agoSo we must also demand that we be able to change the software. For hardware, we could demand that universities get paid to look at samples of hardware to find backdoors, maybe.
- thomastjeffery 9y agoThat's only part-true. We could use reproducible builds too. Either way, we shouldn't reject the only solution because it has edge cases.
- thomastjeffery 9y agoThat is the problem: "we" don't have a solution. That's why we needed to get rid of DMCA Section 1201, and demand access to source code, at the very least, for security research.
- daddosi 9y agoI've always argued (not always seriously) that closed source anything should be illegal. The response is often: But how do I exploit? The desire to exploit is apparently as strong as the desire to cry CONSPIRACY THEORIES which in all honesty is just 1984 style crimestop. If gubberment can backdoor your head like that no system is safe :P Lets just make open sourcre the rule and be done with it. You all like open source and you are going to keep it. This is why you agree.
- userbinator 9y agoWD probably contracted D-Link to make these devices for them, i.e. D-Link is the OEM. The latter has been known for quite a few router vulnerabilities... ...but on the bright(?) side, I remember finding lots of software and other fun stuff on "public" D-Link NASes a few years ago, including information critical to repairing the products of one well-known and notoriously-closed company. ;-)
- oceanghost 9y agoIs anyone aware of a way to put a non-crappy OS on the PR4100?
- duxup 9y agoAny ideas on why WD and D-Link share the same hard coded user and password?
- astura 9y agoEither both contracted the software out to the same third party company who reused code or one contracted the software out to the other. I've personally seen and worked on, many times, code originally developed for one customer reused in another project for another customer. Mind you, this is totally legal the way our contracts are worded. For all we know WD could have paid DLink to produce the whole damn thing and just stick a WD logo on them. That sort of thing is far from unheard of.
- mjg59 9y agoPossibly implemented by the same third party vendor.
- ComodoHacker 9y agoLooking at the code, it was the cheapest bidder from Upwork.
- linkmotif 9y agoWhat’s the connection to D-Link about?
- paulie_a 9y agoThey probably made it oem for wd
- fernly 9y agoRead the original article to the end: " the D-Link DNS-320L had the same exact hard coded backdoor and same exact file upload vulnerability that was present within the WDMyCloud. So, it seems that the WDMyCloud software shares a large amount of the D-Link DNS-320L code, backdoor and all. There are also other undeniable examples such as misspelled function names and other anomalies that match up within both the WDMyCloud and the D-Link DNS-320L ShareCenter code."
- linkmotif 9y agoYeah I read that. Was wondering still why the two companies would be related. Other responder suggests an OEM.
- caconym_ 9y agoWhat an excellent way to ensure I don't even spare a glance for your products before going with the competition's offering(s).
- the_common_man 9y agoAny recommended competitors?
- TheDong 9y agoBuild your own and use one of FreeNAS, Rockstor, or roll your own (as I have with ZFS on Linux). I can't recommend any competitors specifically since I've just been building my own, but last I looked drobo didn't look that bad.
- rhexs 9y agoI really love my QNAP device, but the software stack is so amazingly complex it sort of scares me how many vulnerabilities might be lurking. Hopefully the QNAP security team is full of decent folks. For reference, I have a QNAP j3455 device. Remotely streams up to 4 hardware accelerated plex streams, runs lots of SSL connections, hosts all my files in a myriad of cool ways, never gets about 30% CPU load. It's amazing.
- ronnier 9y agoI build my own with Unraid. https://lime-technology.com https://lime-technology.com
- dvtv75 9y agoI was rather hoping that someone would list some low power options. When I look into building my own, I usually end up looking at what is basically a PC, with typical PC power draw.
- PascLeRasc 9y agoSynology. Their software is the OS X of NAS's. Everything is laid out logically and they have great long-term support. They're the only NAS manufacturer with a statement about Meltdown that I could find. Try it here if you want: https://www.synology.com/en-us/dsm/live_demo https://www.synology.com/en-us/dsm/live_demo
- mindfulhack 9y agoThank fuck for security research and hackers.
- Animats 9y agoA general question: why is no one suing people who put in back doors? Where are the "reckless negligence" suits? Especially injured third parties, who never agreed to an overreaching EULA.
- posterboy 9y agoYou can't sue on formal grounds, you need a material claim that your rights have been hurt. reckless negligence sounds like a criterion to determine whether the damage is actually a liability of the defendant. And that you had to install a patch, which is available according to other comments, is likely not enough. Unless there are rules I don't know about, or you can construct an argument that backdoors were per se illegal. Maybe you could claim that someone is offering copyrighted material on the internet, because that's illegal per se, no downloading required, but beware of the backfire.
- astura 9y agoOff the top of my head I recall there was the Sony rootkit lawsuit: https://www.cnet.com/news/sony-settles-rootkit-class-action-lawsuit/ https://www.cnet.com/news/sony-settles-rootkit-class-action-...
- bo1024 9y agoThat went way beyond a backdoor, that was active malware.
- tehwebguy 9y agoI was approached on Twitter by an attorney for a class action against Payfone et al when their demo popped up here. It won’t take much effort to find one who sees a case here.
- simcop2387 9y agoThey do sometimes, Trendnet is still dealing with the settlement, https://en.wikipedia.org/wiki/In_re_TRENDnet,_Inc https://en.wikipedia.org/wiki/In_re_TRENDnet,_Inc.
- Geee 9y agoIs there a way to crowdfund security research? We need more people looking into these.
- simooooo 9y agoWasn't that how they did truecrypt/openSSL?
- patrickdavey 9y agoCorrect me if I'm wrong but if this is on your home network then you're only vulnerable to other people on your network right? Just don't port forward access for a start.
- Someone1234 9y agoThis is expressly covered in the article ("02.2 - Remote exploitation"). No, in answer to your question, an iFrame on a website you visit can execute commands on your LAN accessible MyCloud.
- EgoIncarnate 9y agoGenerally when it's something this obvious I think it's a backdoor for debugging that got left in due to bad development practices. [1] If someone actually wanted to implant a "secret" backdoor it would be disguised as a subtle bug and/or obfuscated in some way. "Never attribute to malice that which is adequately explained by stupidity." Hanlon's Razor - https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor [1] "[...] it turns out the error was caused due to buggy code and nothing I was or wasn't doing wrong." - if the code is so obviously buggy and the backdoor part isn't obviously a bug, the developers are probably just being sloppy, not malicious (bad or rushed development).
- jhiska 9y agoAh, yes; the Russian defense. I know it well. How did it go? "The hard-coded backdoor that was found can't be a hard-coded backdoor, because Western Digital would never be so crass and incompetent as to put a hard-coded backdoor hidden in such a way that a security researcher would find it and attribute it to them." How can one argue against such flawless logic when it even has an aphorism to describe it?
- justinpombrio 9y ago> How can one argue against such flawless logic when it even has an aphorism to describe it? How about creating a new aphorism? "Never attribute to stupidity alone that which is adequately explained by both stupidity and malice."
- EgoIncarnate 9y agoDoes that logic apply to Occam's razor too? Never choose the simple explanation when a complex one is available? :-)
- jhiska 9y agoThe keyword in the rule of thumb known as Occam's razor is neither that the explanations be simple or complex, but that they be adequate to a knowledgeable person, and that given two (or more) highly adequate explanations -- one simple and one (or more) complex -- that the complex ones be cut in favor of the simplest one. I guess the answer is no.
- jchw 9y agoWell, shit. I've had one of these as a stand-in for hopefully eventually getting a Synology NAS, and now I'm paranoid about continuing to use my WD MyCloud. The thing is, I do believe I have a lot of reasons to believe I can trust Synology more, I don't even want to trust anyone. Not Intel or AMD, not WD or Synology. Computers are quickly becoming a source of implicit distrust for me.
- ronnier 9y agoI just build my own with Unraid and I love it. https://lime-technology.com/ https://lime-technology.com/
- mey 9y agoI'm having modest success using an eSATA enclosure on Windows with Storage Spaces. On the Linux side, BTRFS may be suitable but harder to manage (This is part of what Synology/NetGear are providing management around.)
- paulie_a 9y agoIn my experience btrfs is not suitable for anything.
- jchw 9y agoUnfortunately, I've learned this the hard way. Twice. I'm sure it's more stable now than it was when I used it last, but it's frustrating when people say "no, this time it's really stable!" and then you lose data due to a bug. This same thing has never happened to me with ZFS on Linux, which is a shame because the licensing issues make it painful for me to use. I like up to date kernels. I feel like btrfs should be phased out. It was clearly developed in a fashion that did nothing to prevent preventable bugs. This may be the same frustration that's leading RedHat to work on their own competing filesystem...
- mey 9y agoAny suggestions for a dynamically grow-able/shrinkable system of mixed drives for linux? When I last looked (and why I went with Storage Spaces) was that ZFS requires pools to be fixed at initialization, and I wasn't sure what other OSS solutions were mature at the time.
- xioxox 9y agoThe article doesn't seem to make clear that the 04 firmware which fixes this has been out for years (mid 2014, specifically). One nice thing about this device is that it is a real Linux system which can be used for hosting cheap services.
- emcrazyone 9y agoThe article mentions firmware version 2.30.165 where as mine is running 2.11.168 and when checking for updates, reports back I have the latest. I have the EX4 models. I only run mine on private/home networks with no remote access in to them. Curious about the version difference...
- bmaupin 9y ago2.11.168 is the latest firmware for My Cloud Mirror gen 1 [1]. 2.30.165 is the latest firmware for My Cloud Mirror gen 2 [2]. Both firmwares were released in Nov 2017, and I suspect the vulnerabilities were fixed at that time as well. At the very least nas_sharing.cgi was removed in both versions. But I haven't had a chance to finish my investigations [3]. [1] https://support.wdc.com/downloads.aspx?g=907 https://support.wdc.com/downloads.aspx?g=907 [2] https://support.wdc.com/downloads.aspx?g=910 https://support.wdc.com/downloads.aspx?g=910 [3] https://gist.github.com/bmaupin/c38c777a0e4fad737a14718b10928fe4 https://gist.github.com/bmaupin/c38c777a0e4fad737a14718b1092...
- deleted 9y ago[deleted]
- bmaupin 9y agoFrom what I can tell the hard-coded backdoor vulnerability was remediated, but I see no indication the unrestricted file upload vulnerability has been remediated in any of the firmwares I tested. But I'm not a security expert. I've reached out to Gulftech and WD for clarification.
- nitrogen 9y agoWatch out for things like <img src="http: / / your_nas_ip?backdoor&evil+stuff"> on random websites. They can put in 500+ images to cover all of 192.168.0.0/23.
- l0b0 9y agoSide note: Can't reach over HTTPS, access denied via Tor. Why do so many security-related sites use awful hosting providers?
- freestockoption 9y agoFYI, some MyCloud devices can be modified to just run Debian. I treat my MyCloud as a cheap Linux box with lots of storage in a convenient form factor. If it weren't for that, I'd just build a computer.
- daniel_iversen 9y agoWell crap! I bet this gives a lot of WD customers a sick feeling in their stomach. Is nobody worthy of our trust anymore! :|
- mmaunder 9y agoAccording to the research, this may be wormable and is browser exploitable, assuming they can figure out the local hostname/IP of your NAS.
- akerro 9y agoFFS can't you just buy anything these days without worrying about backdoors, vulnerabilities in CPUs, MOBO? Why we just can't have nice things? Why do browsers have to run DRM, CPU can be controlled by any USB driver, MOBOs have webservers with code execution from LAN and internet. IoT cameras make biggest botnets ever known. At this point I'm just waiting for a fucking internet controlled kettles and ovens that will burn down neighbourhoods and cities.
- deleted 9y ago[deleted]
- EgoIncarnate 9y agoEconomics. Enough people prefer faster and cheaper. Security and reliability cost time and money. By the time your product ships it's already obsolete and still costs more than customers are willing to pay. Probably won't change until the costs of these types of bugs/design flaws outweigh the costs of preventing them.
- probablybroken 9y agoSurely, not putting in a backdoor is a cost saving measure though?
- supergreg 9y agoIt could be if there's someone willing to pay for it being added.
- EgoIncarnate 9y agoIf the backdoor was a hack for easier debugging that got left in, not having it during development could make for a longer more expensive development cycle. In which case it should have been removed before production. It could also be intended as a support tool to ease hard to debug solutions remotely. Not having it could make support issues more expensive and slower. Very insecure and misguided (security by obscurity is not security) if this is the case, but not malicious. Just a stupid attempt at saving money. This apparently was the case for another commenter on a different product. While it's possible it was placed with malicious intent, there are plausible (and all too common) alternatives that explain it.
- newb88 9y agoI recently installed one of these in my home, what actions would you suggest I take?
- bmaupin 9y agoI haven't had a chance to finish my investigations yet, but at least part of the vulnerabilities were corrected with the latest firmware, so I'd start by updating the firmware. I wrote more here: https://news.ycombinator.com/item?id=16091555 https://news.ycombinator.com/item?id=16091555